{ "annotations": { "list": [ { "builtIn": 1, "datasource": { "type": "grafana", "uid": "-- Grafana --" }, "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "type": "dashboard" } ] }, "editable": true, "fiscalYearStartMonth": 0, "graphTooltip": 1, "links": [], "liveNow": false, "panels": [ { "type": "text", "title": "How to read this dashboard", "gridPos": { "h": 5, "w": 24, "x": 0, "y": 0 }, "id": 100, "options": { "mode": "markdown", "content": "**Identity is the phone's MAC**, lifted out of the message body into a `mac` label by Alloy (Yealink `static.syslog.prepend_mac_address.enable`). Do **not** use `source_ip` as identity — phones are on DHCP with a 1200 s lease, so a re-IP looks like a new device and a recycled IP would inherit another phone's history. Only devices sending a MAC appear here, so switches sharing this Loki are excluded automatically. *Data from before the MAC rollout has no `mac` label and will not show.*\n\n**A silent phone is a healthy phone, not a missing one.** Most of the fleet runs at Yealink's default log level **3 (Error)** and only speaks when something is wrong. A couple of handsets are at level **6 (Informational)** and produce ~80% of all volume. These panels count *phones heard from*, never *phones alive* — and the registration/DHCP panels at the bottom can only ever populate for level-6 phones.\n\n**Two known noise sources are filtered out:** `severity=emergency` is Yealink printing its own log-level table at boot (`E=3,W=4,N=5,I=6,D=7`), not an incident; and `LSYS<3+error> rtpcap get len not enough` was 56% of all error lines in baseline. Neither means anything.\n\n**No colour thresholds on the counts — deliberately.** The fleet onboarded 2026-07-15, so there is no representative 24 h baseline to derive them from, and fleet-wide sums scale with phone count rather than with health. The panels are *comparative* (worst offenders) instead. Revisit once a full week of fleet data exists." } }, { "type": "stat", "title": "Phones heard from", "description": "Distinct MACs that sent at least one line in range. NOT a health count — level-3 phones stay silent unless something breaks, so this is expected to sit well below the fleet size.", "gridPos": { "h": 4, "w": 4, "x": 0, "y": 5 }, "id": 1, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} [$__range])))", "queryType": "instant" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] } }, { "type": "stat", "title": "Log lines", "description": "Total lines from MAC-identified phones in range.", "gridPos": { "h": 4, "w": 4, "x": 4, "y": 5 }, "id": 2, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "sum(count_over_time({job=\"syslog\", mac=~\"$phone\"} [$__range]))", "queryType": "instant" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] } }, { "type": "stat", "title": "Phones with errors", "description": "How many distinct handsets logged at least one actionable error (rtpcap noise floor excluded). A count of affected devices — unlike a fleet-wide error total, this does not inflate as phones are added.", "gridPos": { "h": 4, "w": 4, "x": 8, "y": 5 }, "id": 3, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\" [$__range])))", "queryType": "instant" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] } }, { "type": "stat", "title": "Phones failing provisioning", "description": "Handsets hitting 'tftp to file failed' or 'no config Provisioning Server'. Any non-zero value is worth a look regardless of fleet size — this is a qualitative fault, not a magnitude, which is why it carries a threshold when the count panels deliberately do not.", "gridPos": { "h": 4, "w": 4, "x": 12, "y": 5 }, "id": 4, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"tftp to file failed|no config Provisioning Server\" [$__range])))", "queryType": "instant" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "value", "graphMode": "none", "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "thresholds" }, "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }, { "color": "yellow", "value": 1 }] } }, "overrides": [] } }, { "type": "stat", "title": "Phones with auth failures", "description": "Handsets logging CUIT 'check passwd err' — a credential rejection on the phone's own web/UI. Could be a mis-provisioned password or someone probing; read the log panel below rather than treating the number as a score.", "gridPos": { "h": 4, "w": 4, "x": 16, "y": 5 }, "id": 5, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"check passwd err\" [$__range])))", "queryType": "instant" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] } }, { "type": "stat", "title": "Phones with scheduler timeouts", "description": "Handsets logging DEV 'data_task schedule time out' — the phone's internal scheduler overran its 30 s threshold. The best available proxy for 'this handset is struggling'.", "gridPos": { "h": 4, "w": 4, "x": 20, "y": 5 }, "id": 6, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"data_task schedule time out\" [$__range])))", "queryType": "instant" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "colorMode": "none", "graphMode": "none", "textMode": "auto" }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] } }, { "type": "bargauge", "title": "Worst phones by actionable errors", "description": "Comparative, not absolute — find the outlier rather than judge against a made-up number. Keyed on MAC, so a phone that changes IP stays the same bar.", "gridPos": { "h": 9, "w": 12, "x": 0, "y": 9 }, "id": 7, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\" [$__range])))", "queryType": "instant", "legendFormat": "{{mac}}" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "displayMode": "gradient", "orientation": "horizontal", "showUnfilled": true }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "continuous-GrYlRd" } }, "overrides": [] } }, { "type": "bargauge", "title": "Loudest phones by log volume", "description": "Identifies handsets left at log level 6 (Informational). Yealink's default is level 3 (Error); a phone near the top here is verbose by configuration, not necessarily unhealthy — but it dominates disk and query cost.", "gridPos": { "h": 9, "w": 12, "x": 12, "y": 9 }, "id": 8, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} [$__range])))", "queryType": "instant", "legendFormat": "{{mac}}" } ], "options": { "reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }, "displayMode": "gradient", "orientation": "horizontal", "showUnfilled": true }, "fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "continuous-BlPu" } }, "overrides": [] } }, { "type": "timeseries", "title": "Actionable errors by Yealink module", "description": "Module tag parsed from the message body (it is not a label). CFG = config attribute lookups, DEV = scheduler, CUIT = auth, ATP = provisioning/transfer, WEB = web UI, LSYS = RTP capture.", "gridPos": { "h": 8, "w": 12, "x": 0, "y": 18 }, "id": 9, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "sum by (module) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\" | regexp \"(?P[A-Z]{2,5}) *<3[+]error\" [$__interval]))", "queryType": "range", "legendFormat": "{{module}}" } ], "options": { "legend": { "displayMode": "table", "placement": "right", "showLegend": true, "calcs": ["sum"] }, "tooltip": { "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "unit": "short", "custom": { "drawStyle": "bars", "lineWidth": 0, "fillOpacity": 80, "stacking": { "mode": "normal", "group": "A" }, "showPoints": "never" } }, "overrides": [] } }, { "type": "timeseries", "title": "Severity mix (emergency excluded — see notes)", "description": "severity=emergency is filtered out: on Yealink it is the boot-time log-level table, not an incident.", "gridPos": { "h": 8, "w": 12, "x": 12, "y": 18 }, "id": 10, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "sum by (severity) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity!=\"emergency\"} [$__interval]))", "queryType": "range", "legendFormat": "{{severity}}" } ], "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }, "fieldConfig": { "defaults": { "unit": "short", "custom": { "drawStyle": "bars", "lineWidth": 0, "fillOpacity": 70, "stacking": { "mode": "normal", "group": "A" }, "showPoints": "never" } }, "overrides": [ { "matcher": { "id": "byName", "options": "error" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "red" } }] }, { "matcher": { "id": "byName", "options": "warning" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "orange" } }] }, { "matcher": { "id": "byName", "options": "notice" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "blue" } }] }, { "matcher": { "id": "byName", "options": "informational" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "green" } }] } ] } }, { "type": "logs", "title": "Signals that matter — auth, provisioning, scheduler", "description": "The three narrow patterns confirmed to carry real operational meaning. Read this first when a phone is reported faulty. Labels show both mac (stable identity) and source_ip (where it is on the network right now).", "gridPos": { "h": 10, "w": 24, "x": 0, "y": 26 }, "id": 11, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"check passwd err|tftp to file failed|no config Provisioning Server|data_task schedule time out\"", "queryType": "range" } ], "options": { "showTime": true, "showLabels": true, "showCommonLabels": false, "wrapLogMessage": true, "enableLogDetails": true, "dedupStrategy": "none", "sortOrder": "Descending" } }, { "type": "logs", "title": "All actionable errors (rtpcap noise floor removed)", "gridPos": { "h": 10, "w": 24, "x": 0, "y": 36 }, "id": 12, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "{job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\"", "queryType": "range" } ], "options": { "showTime": true, "showLabels": true, "showCommonLabels": false, "wrapLogMessage": true, "enableLogDetails": true, "dedupStrategy": "exact", "sortOrder": "Descending" } }, { "type": "timeseries", "title": "SIP registration refresh (level-6 phones only)", "description": "REG 'Register: update server' fires at info level, so ONLY handsets left at log level 6 appear here. A gap for such a phone means it lost registration to the PBX (192.168.0.8); an absent phone means it is at level 3, NOT that it is unregistered.", "gridPos": { "h": 7, "w": 12, "x": 0, "y": 46 }, "id": 13, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Register: update server\" [$__interval]))", "queryType": "range", "legendFormat": "{{mac}}" } ], "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi" } }, "fieldConfig": { "defaults": { "unit": "short", "custom": { "drawStyle": "points", "pointSize": 5, "lineWidth": 1, "fillOpacity": 0, "showPoints": "always" } }, "overrides": [] } }, { "type": "logs", "title": "DHCP lease events (level-6 phones only)", "description": "Lease acquisition/renewal as the phone sees it — notice level, so the same caveat as the registration panel. Useful when a handset is 'connected but dead'. Observed lease time is 1200 s, which is exactly why source_ip is not a safe identity.", "gridPos": { "h": 7, "w": 12, "x": 12, "y": 46 }, "id": 14, "datasource": { "type": "loki", "uid": "${datasource}" }, "targets": [ { "refId": "A", "datasource": { "type": "loki", "uid": "${datasource}" }, "expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"lease of .* obtained|lease renew\"", "queryType": "range" } ], "options": { "showTime": true, "showLabels": true, "showCommonLabels": false, "wrapLogMessage": true, "enableLogDetails": true, "dedupStrategy": "none", "sortOrder": "Descending" } } ], "refresh": "5m", "schemaVersion": 39, "tags": ["yealink", "phones", "syslog", "02-tekhnohim"], "templating": { "list": [ { "name": "datasource", "label": "Datasource", "type": "datasource", "query": "loki", "current": {}, "hide": 0, "refresh": 1, "regex": "", "skipUrlSync": false }, { "name": "phone", "label": "Phone (MAC)", "description": "Device identity. allValue is '.+' (not '.*') so that 'All' matches only streams that HAVE a mac label — which excludes switches and other non-Yealink senders sharing this Loki.", "type": "query", "datasource": { "type": "loki", "uid": "${datasource}" }, "definition": "label_values({job=\"syslog\"}, mac)", "query": { "label": "mac", "refId": "LokiVariableQueryEditor-VariableQuery", "stream": "{job=\"syslog\"}", "type": 1 }, "current": { "selected": true, "text": ["All"], "value": ["$__all"] }, "includeAll": true, "multi": true, "allValue": ".+", "hide": 0, "refresh": 2, "sort": 1, "skipUrlSync": false } ] }, "time": { "from": "now-24h", "to": "now" }, "timepicker": {}, "timezone": "browser", "title": "Yealink IP phones — syslog health", "uid": "yealink-phones", "version": 2, "weekStart": "" }